Packet routing system and method

ABSTRACT

A flexible, scalable hardware and software platform that allows a service provider to easily provide internet services, virtual private network services, firewall services, etc., to a plurality of customers. One aspect provides a method and system for delivering security services. This includes connecting a plurality of processors in a ring configuration within a first processing system, establishing a secure connection between the processors in the ring configuration across an internet protocol (IP) connection to a second processing system to form a tunnel, and providing both router services and host services for a customer using the plurality of processors in the ring configuration and using the second processing system, a packet routing system and method is described that includes a processor identifier in each packet to route the packets to a physical processor, and a logical queue identifier to route the packets to the destination object within that processor.

CROSS-REFERENCE TO RELATED INVENTIONS

This application is a Continuation of U.S. application Ser. No.09/661,636 filed on Sep. 13, 2000. This application is also related toU.S. application Ser. No. 09/661,637 filed on Sep. 13, 2000. Thisapplication is also related to U.S. Provisional Application Ser. No.60/232,516 filed on Sep. 13, 2000 and U.S. Provisional Application Ser.No. 60/232,577 filed on Sep. 13, 2000. All of which are herebyincorporated by reference for all purposes.

FIELD OF THE INVENTION

This invention relates to the field of internet processors, and morespecifically to a method and apparatus of delivering security servicessuch as firewalls.

BACKGROUND OF THE INVENTION

The service provider game has grown extremely crowded and fiercelycompetitive, with numerous players offering similar products andservices. While having a large number of comparable services is arguablybeneficial to the enterprise, it poses a host of potentially disastrousconsequences for a service provider. If all competitors in a givenmarket are offering services that are indistinguishable by the customerbase, the burden of differentiation falls squarely on cost, with theleast-cost competitor emerging “victorious”. Jockeying for thecost-leader position rapidly drives down service pricing, reducingmargins to rubble and rendering the service a commodity. Furthermore,numerous offerings that are similar in attributes and cost make it verydifficult to lock in customers.

Operational costs also present a significant challenge to serviceproviders. Cumbersome, manual provisioning processes are the primaryculprits. Customer orders must be manually entered and processed throughnumerous antiquated backend systems that have been pieced together. Oncethe order has been processed, a truck roll is required for onsiteinstallation and configuration of Customer Premises Equipment (CPE), aswell as subsequent troubleshooting tasks. This is a slow and expensiveprocess that cuts into margins and forces significant up-front chargesto be imposed on the customer. In order to be successful in today'smarket, service providers must leverage the public network to offerhigh-value, differentiated services that maximize margins whilecontrolling capital and operational costs. These services must berapidly provisioned and centrally managed so that time-to-market and,more importantly, time-to-revenue are minimized. Traditional methods ofdata network service creation, deployment, and management presentsignificant challenges to accomplishing these goals, calling for a newnetwork service model to be implemented.

Basic Internet access, a staple of service provider offerings, has beencommoditized to the point that margins are nearly non-existent. Thisfact has driven service providers to look for new value-added featuresand services to layer over basic connectivity so that they are able todifferentiate on factors other than cost. The most significantopportunity for differentiation is found in managed network services.Managed network services enable enterprise IT organizations to outsourcetime-consuming tactical functions so that they can focus strategic corebusiness initiatives.

Enterprise customers are now demanding cost-effective, outsourcedconnectivity and security services, such as Virtual Private Networks(VPNs) and managed firewall services. Enterprise networks are no longersegregated from the outside world; IT managers are facing mountingpressure to connect disparate business units, satellite sites, businesspartners, and suppliers to their corporate network, and then to theInternet. This raises a multitude of security concerns that are oftenbeyond the core competencies of enterprise IT departments. To compoundthe problem, skilled IT talent is an extremely scarce resource. Serviceproviders, with expert staff and world-class technology and facilities,are well positioned to deliver these services to enterprise customers.

While IT managers clearly see the value in utilizing managed networkservices, there are still barriers to adoption. Perhaps the mostsignificant of these is the fear of losing control of the network to theservice provider. In order to ease this fear, a successful managednetwork service offering must provide comprehensive visibility to thecustomer, enabling them to view configurations and performancestatistics, as well as to request updates and changes. Providing ITmanagers with powerful Customer Network Management (CNM) tools bolstersconfidence in the managed network service provider and can actuallystreamline the service provisioning and maintenance cycle.

Customer Premises Equipment (CPE)-Based Managed Firewall Services

Data network service providers have traditionally rolled out managednetwork service offerings by deploying specialized CPE devices at thecustomer site. This CPE is either a purpose-built network appliancethat, in addition to providing specific service features, may also servesome routing function, or a mid to high-end enterprise-class serverplatform, typically UNIX-based. In the case of a managed firewallsolution, the CPE device provides services that may include VPN tunneltermination, encryption, packet filtering, access control listings, andlog files. The CPE at each customer site is aggregated at a multiplexervia leased lines and/or public Frame Relay PVCs (permanent virtualcircuits) at the service provider POP (point of presence), then into ahigh-end access router and across the WAN (wide area network).

In many cases, service providers and enterprise customers find it tooexpensive and cumbersome to deploy CPE-based security at every site, butrather deploy secure Internet access points at one or two of the largestcorporate sites. In this model, all remote site Internet traffic isbackhauled across the WAN to the secure access point and then out ontothe Internet, resulting in increased traffic on the corporate networkand performance sacrifices.

Service providers face significant challenges when deploying, managingand maintaining CPE-based managed firewall services. When a customerexpresses interest in utilizing such a service, a consultation withexperienced security professionals is required to understand thecorporate network infrastructure and site-specific securityrequirements, yielding a complex set of security policies. This may beaccomplished through a set of conference calls or a number of on-sitevisits. Once the security requirements and policies have beenidentified, the service provider must procure the CPE device. In somecases, the equipment vendor may provide some level of pre-configurationbased upon parameters supplied by the service provider. While CPEvendors are driving towards delivering fully templatized, pre-configuredsystems that are plug-and-play by enterprise staff, most serviceproviders still assume the responsibility for on-site, hands-onconfiguration, and a truck-roll to each of the customer sites isnecessary. This is particularly true in server-based CPE systems, wherea relatively high degree of technical sophistication and expertise isrequired to install and configure a UNIX-based system.

Typically, a mid-level hardware and security specialist is sent onsite,along with an account manager, to complete the CPE installation andconfiguration. This specialist may be a service provider employee or asystems integrator/Value-Added Reseller (VAR) who has been contracted bythe service provider to complete CPE rollout. This complex processbegins with physical integration of the CPE device into the customernetwork. In the case of a CPE appliance, where the OS and firewall/VPNsoftware components have been pre-loaded, the tech can immediatelyproceed to the system configuration phase. Server-based CPE services,however, require the additional time-consuming step of loading thesystem OS and software feature sets, adding a further degree ofcomplexity.

In the configuration phase, the tech attempts to establish contactbetween the CPE device and central management system at the serviceprovider NOC (network operations center). In cases where the device hasnot been previously assigned an IP address, an out-of-band signalingmechanism is required to complete the connection, typically a modem anda POTS line. If the integration process has been successful, NOC staffshould be able to take over the process, pushing specific policyconfigurations (and possibly an IP address) down to the CPE devicethrough a browser-driven management interface. This entire process mustbe repeated for every enterprise site utilizing the managed firewallservice.

Additionally, maintenance processes and costs for CPE-based managedfirewall services can also be overwhelming to both the service providerand enterprise customers. Enterprises are forced to either keep coldspares onsite or be faced with periods of absent security when theirfirewall fails, a situation that is unacceptable to most of today'sinformation intensive corporations. Service providers must have aninventory of spares readily available, as well as staff resources thatcan, if necessary, go onsite to repeat the system configuration process.Troubleshooting thousands of CPE devices that have been deployed atcustomer sites is an extremely formidable challenge, requiring extensivecall center support resources, as well technicians that can be quicklydeployed onsite.

As CPE-based firewall services have traditionally been deployed inprivate enterprise networks, the original management systems for thesedevices have difficulty scaling up to manage several large, multi-siteservice provider customers. CPE device vendors are scrambling to ramp upthese systems to carrier-grade and scale. Firewall management systemsare typically GUI-based (graphical user interface-based), browser-driveninterfaces that run on industrial grade UNIX platforms in the serviceprovider NOC. The management system interfaces with the CPE devicesbased on IP address. The CPE-based managed firewall model faces serviceproviders with another issue: capital costs. In addition to thesignificant costs required to build out a POP/access infrastructure,including multiplexers and high-capacity access routers, the serviceprovider must also assume the initial costs of the CPE device, includingfirewall and VPN software licensing charges. In many cases, these costsare passed on to the customer. This creates steep up-front costs that,coupled with per-site installation charges, can present a seriousbarrier to service adoption. In markets where several service providersare offering managed firewall services, a service provider may absorbthe CPE cost to obtain a price leadership position, cutting deeply intomargins.

The CPE-based model is also limited when rolling out services beyond themanaged firewall offering. New services, such as intrusion detection,may require additional hardware and/or software. This results in highercapital costs, as well as another expensive truck roll.

Thus, there is a need for a method and apparatus of delivering a varietyof network services, for example security services such as firewalls.

SUMMARY OF THE INVENTION

The present invention provides a flexible, scalable hardware andsoftware platform that allows a service provider to easily provideinternet services, virtual private network services, firewall services,etc., to a plurality of customers. This solution can be changes toprovision each customer with more or less processing power and storage,according to individual changing needs a packet routing system includesa processor identifier as part of each packet to route the packets to aphysical processor, and a logical queue identifier to route the packetsto the destination object within that processor.

One aspect of the present invention provides a method of packet routing.The method includes connecting a plurality of processors in a network,assigning a unique processor identifier (PEID) to each of theprocessors, routing a first packet to a first one of the processorsacross the network, wherein each such packet includes a PEID valuecorresponding to a PEID of one of the processors, and wherein therouting to the first processor is based on the PEID value in the firstpacket, establishing a plurality of objects in the first processor,assigning a logical queue identifier (LQID) to a first one of theobjects in the first processor, wherein each packet also includes anLQID value corresponding to an LQID of one of the objects, and routingthe first packet to the first object based on the LQID value in thefirst packet.

Another aspect of the present invention provides a system for routingpackets. This system includes a plurality of processors coupled to oneanother using a network, wherein each of the processors a uniqueprocessor identifier (PEID), wherein a first packet is routed into afirst one of the processors across the network, wherein each such packetincludes a PEID value corresponding to a PEID of one of the processors,and wherein the routing to the first processor is based on the PEIDvalue in the first packet, a plurality of objects in the firstprocessor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, and software for routingthe first packet to the first object based on the LQID value in thefirst packet.

Still another aspect of the present invention provides a system forrouting packets. This system includes a plurality of processors coupledto one another using a network, wherein each of the processors a uniqueprocessor identifier (PEID), wherein a first packet is routed into afirst one of the processors across the network, wherein each such packetincludes a PEID value corresponding to a PEID of one of the processors,and wherein the routing to the first processor is based on the PEIDvalue in the first packet, and a plurality of objects in the firstprocessor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, wherein the first packetis routed to the first object based on the LQID value in the firstpacket.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of one embodiment of the present invention,system 100 having a plurality of ISP boxes 110 connected to the internet99

FIG. 2 is a block diagram of one embodiment of the present invention,service provider network 200.

FIG. 3 is a block diagram of one embodiment of the present invention, anIP service delivery platform 300.

FIG. 4 is a block diagram of one embodiment of the present invention, asystem 400 providing a plurality of virtual private networks 410, 420,430, 440.

FIG. 5 is a block diagram of one embodiment of the present invention, aring-network hardware platform 230.

FIG. 6 is a block diagram of one embodiment of the present invention,service processing switch 600.

FIG. 7 is a block diagram of one embodiment of the present invention, anintegrated system 700 including conventional existing network elements.

FIG. 8 is a block diagram of one embodiment of the present invention,hardware elements 230 and software elements 220.

FIG. 9 is a block diagram of one embodiment of the present invention,multiprocessor system 900 using ring network 932.

FIG. 10 shows a block diagram of a system 1000 for comparison.

FIG. 11 shows a block diagram of a system 1100 for comparison.

FIG. 12 shows a block diagram of a system 1200 for comparison.

FIG. 13 shows a block diagram of a system 1300 for comparison.

FIG. 14 shows a graph of CheckPoint operational “soft” costs 1400.

FIG. 15 shows a graph of five year total capital cost 1500.

DESCRIPTION OF PREFERRED EMBODIMENTS

In the following detailed description of the preferred embodiments,reference is made to the accompanying drawings that form a part hereof,and in which are shown by way of illustration specific embodiments inwhich the invention may be practiced. It is understood that otherembodiments may be utilized and structural changes may be made withoutdeparting from the scope of the present invention.

The leading digit(s) of reference numbers appearing in the Figuresgenerally corresponds to the Figure number in which that component isfirst introduced, such that the same reference number is used throughoutto refer to an identical component which appears in multiple Figures.Signals and connections may be referred to by the same reference numberor label, and the actual meaning will be clear from its use in thecontext of the description.

In some embodiments, the present invention deploys one or more virtualprivate networks (VPNs) running on one or more carrier-class platformsthat scale to provide cost-effective solutions for internet serviceproviders (ISPs). In particular, security services such as firewalls canbe provided by the ISPs for services they provide to their customers,wherein a plurality of customers are hosted on a single network ofprocessors. An ISP is providing hosting services (e.g., hosting aninternet web site for a customer) and routing (moving data to and fromthe internet) for their customers.

FIG. 1 shows one embodiment of the present invention having a system 100that includes a plurality of similar ISP (internet service provider)boxes 110 connected to the internet 99. In this embodiment, each box 110represents a subsystem having routing services provided by a blockcalled access router 111, and hosting services provided by blocks 113and 114. The ISP is typically a company that provides internet services(such as connectivity to the internet, as well as servers that storedata and provide data according to requests by users, and networkconnectivity to users) to a plurality of customers including customer aand customer B. In some embodiments, customer premises equipment 117 and118 (also called CPE 117 and 118, this is hardware and the software thatcontrols the hardware, that is installed at the customer's premises;this can include servers, routers and switches, and the networkconnecting to individual user's workstations, and various interfaces toexternal communications networks) is used to provide at least a portionof the function to support customers a and B respectively, and the ISP110 provides the rest in blocks 113 and 114 respectively. The functionto support customers includes such things as web site hosting, databaseand other servers, e-mail services, etc. The customer's CPE 117 and 118connect to the ISP through, e.g., access router 111 and securityservices 112 to customer a site one 113 and customer B site one 114, andalso to the internet 99 in a manner that isolates customer a andcustomer B from one another except for communications and E-mail thatwould normally pass across the internet 99.

Further, by establishing secure connections between two ISP boxes 110across the internet 99, a virtual private network or VPN 410 (see FIG. 4below) can be created. This function allows, for example, customer a'soffice at a first site (e.g., headquarters 117) to connect seamlessly tocustomer a's office at a second site (e.g., branch office 119) usingwhat appears to them as a private network, but which actually includessome CPE at site 117, some services 113 provided within ISP 110.1, asecure encrypted connection across internet 99, some services also inISP 110.2, and some CPE at site 119. Users at sites 117 and 119 cancommunicate with one another and share data and servers as if they wereon a single private network provided by, e.g., VPN 410.

FIG. 2 is a block diagram of one embodiment of the present invention,service provider (SP) network 200. a conventional network “cloud” 98includes the SP's internet protocol (IP) or asynchronous transfer mode(ATM) core, as is well known in the internet art. IP system 201 connectsto such existing infrastructure 98, as well as to other optionalconventional hardware such as described in FIG. 2 below, to provide SPnetwork 200. IP System 201 provides hardware 230 and software 220 toprovide a plurality of virtual routers (VRs) 210. Each VR 210 providessupport for router services and server services such as those thatprovide customer site services 113 of FIG. 1. Each VR 210 is supportedby an object group 211, which is a group of generally dissimilar objectssuch as routing object 212, packet filtering object 213, firewall object212, network address translation (NAT) object 215, and/or other objects.In some embodiments, each VR 210 is a separate instantiation.

In some embodiments, software 220 includes IP network operating system(IPNOS) 223, service management system (SMS) 221 (e.g., in someembodiments, this is the Invision™ software from CoSine CommunicationsInc., assignee of the present invention), and customer networkmanagement system (CNMS) 222 (e.g., in some embodiments, this is theInGage™ software from CoSine Communications Inc., assignee of thepresent invention). SMS 221 provides such services as configuration ofblades 239, defining subscribers, determining services, and generationof IP security (IPSec) public/private key pairs. CNMS 222 provides suchservices as providing subscribers (customers) visibility to services. Insome embodiments, CNMS software runs at least in part in a user's CPE orworkstations, typically at a company's information services (IS)headquarters.

In some embodiments, IP server switch (IPSX) hardware 230 includes oneor more scalable hardware enclosures, each having a plurality of service“blades” 239 (i.e., an insertable and removable printed circuit cardhaving one or more processors, each having its own CPU and memory) eachconnected in a ring configuration (such as a counter-rotating dual ring232). In some embodiments, three types of blades 239 are provided:control blade(s) 234, processor blade(s) 236, and access blade(s) 238.IPSX hardware also includes highly available, redundant, andhot-swappable hardware support 240 including power supplies 241 and fans242.

FIG. 3 is a block diagram of one embodiment of the present invention, anIP service delivery platform (IPSDP) 300. The hardware and software ofSP network 200 can be viewed as generating various network “clouds” suchas edge cloud 95, access concentration cloud 96, and service processingcloud 97. These are built upon the existing conventional SP's IP or ATMcore cloud 98 and they connect to the external internet cloud 99. IPSDP300 includes an ISP's SP network 200 connected to one or more customer'soffices 301 each of which includes some amount of CPE 110. In theembodiment shown, three corporate remote offices 301.1 are connected toSP network 200 using various conventional communications devices, wellknown to the art, such as frame relay switch 326, M13 multiplexor (mux)327, DSLAM (digital subscriber link access multiplexor) 328, and dial-upRAS (remote access server) 329 (used to receive dial-up connections, forexample, from the modem 311 connected to laptop computer 316 in portablesystem 310 of dial-up telecommuter 301.3). In the embodiment shown, SPnetwork 200 includes two systems 201, on connecting through frame relayswitch 326, M13 multiplexor (mux) 327, DSLAM 328, and dial-up RAS 329 toremote office's CPE 110, and the other connecting directly to thecustomer's corporate headquarter's CPE 1110 (which also includes acontrol and monitoring function provided by CNMS 222) using conventionalcommunications protocols such as frame relay (FR, an access standarddefined by the ITU-T in the I.122 recommendation “Framework forProviding Additional Packet Mode Bearer Services”), internet protocol(IP), FT1 (fractional T1), T1/E1 (a digital transmission link withcapacity of 1.544 Megabits per second), FT3 (fractional T3), T3(capacity of 28 T1 lines), and/or OC3 (optical carrier level 3=threetimes the OC1 rate of 51.840 Mbps)(each of which is a conventionalcommunications service well known to the art).

In some embodiments, IPDSP 300 provides a VPN 410, using secureconnections across the internet 99, to connect remote offices 301 to oneanother.

FIG. 4 is a block diagram of one embodiment of the present invention, asystem 400 providing a plurality of virtual private networks 410, 420,430, 440. VPNs 420, 430, and 440 are each equivalent to the VPN 410 thatsupports subscriber 1, except that they are for other subscribers. Eachsubscriber has a set of partitioned virtual routers 210. For example,subscriber I has two locations, 411 and 412, connected in a VPN 410. VR210 at location 411 can include some CPE 110 as well as support providedin system 201-1. VR 210 at location 412 can include some CPE 110 as wellas support provided in system 201-2. These two VRs 210 establish a“tunnel,” a secure connection, that allows them to maintain securecommunications that support the VPN 410 even across packet networks suchas the internet 99. Each VR 210 is the equivalent of an independenthardware router. Since each VR 410 is supported by an object group 211,objects can be easily added or omitted to enable customized services ona subscriber-by-subscriber basis to meet each subscribers individualneeds. SMS 221 running on SP network 200 allows ease of serviceprovisioning (dynamically adding additional processors/processing powerwhen needed, reducing the processors/processing power used for VPN 410when not needed). In some embodiments, IPNOS 223 uses an openApplication Program Interface (API) to enable new services to be addedto the platform whenever needed.

In some embodiments, system 401 at a first site (e.g., an ISP premiseslocally connected to a customer office) includes IPSX 201-1 having a VR210 connected to CPE 117. This system 401 appears to the outside worldas a single router having firewall services, server(s) and user(s), etc.These functions can be provided by either or both VR 210 and CPE 117,thus allowing a customer to outsource many or most of these services tothe service provider and IPSX 201-1. Similarly, system 402 at a secondsite (e.g., another ISP premises locally connected to a remote office ofthe same customer) includes IPSX 201-2 having a VR 210 connected to CPE119. This system 402 also appears to the outside world as a singlerouter having firewall services, server(s) and user(s), etc. Thesefunctions can be provided by either or both VR 210 and CPE 119, thusallowing a customer to outsource many or most of these services to theservice provider and IPSX 201-2.

FIG. 5 is a block diagram of one embodiment of the present invention, aring-network hardware platform 230. Hardware platform 230 includesplurality of service “blades” 239 (i.e., an insertable and removableprinted circuit card having one or more processors, each having its ownCPU and memory) each connected in a ring configuration (such as acounter-rotating dual ring 232). In some embodiments, three types ofblades 239 are provided: control blade 234 (not shown here), processorblades 236 (providing such functions as point-to-point (PPTP)connectivity, firewall protection against hacking, intruders, oraccidental access), and access blades 238 (providing such functions asNAT, encryption, and routing).

FIG. 6 is a block diagram of one embodiment of the present invention,service processing switch 600. In some embodiments, service processingswitch 600 includes a hardware enclosure 230 having power supplies 241that are hot-swappable, redundant, capable of automatic failover (whenone fails, others take over), and which can be AC or DC sourced. In someembodiments, dual hot-swappable, variable speed fans 242 are provided.In some embodiments, software updates can be made without systemdowntime by swapping out all object groups 211 (virtual routers),changing the software modules, and then resuming processing. In someembodiments, all service blades 239 are hot-swappable (they can beremoved and/or inserted without bringing the system down) and includeautomatic failover from primary mode to protect mode. In someembodiments, dual counter-rotating rings 232 support primary and protectredundancy. In some embodiments, system 600 provides NEBS Level 3compliance and is Y2K ready, provides SONET (synchronous opticalnetwork) 1+1 Line Protection Switching, and includes integrated metalliccross-connects to enable DS3 (digital signal level 3; 44,736,000 bitsper second) blade automatic failover without touching the facility.

FIG. 7 is a block diagram of one embodiment of the present invention, anintegrated system 700 including conventional existing network elements.Integrated system 700 optionally includes conventional frame relayswitch 326, M13 mux 327, DSLAM (DIGITAL SUBSCRIBER LINK ACCESSMULTIPLEXOR) 328, and RAS (REMOTE ACCESS SERVER) 329 connecting tocustomer's equipment such as CPE router 110 and dial-up system 310. Insome embodiments, integrated system 700 optionally includes a core IProuter 720 and/or a core ATM switch as part of an SP core 98. Thisprovides support for a large number of conventional technologystandards, and interoperability with existing access-concentration andcore-network elements. It also offers interworking between frame-relaynetworks and IP networks. Network address translation (NAT) enablesenterprise subscribers to leave their network addressing untouched. Italso enables one to merge IP and legacy networks into one, withcontinuity of service (COS) guarantees.

FIG. 8 is a block diagram of one embodiment of the present invention,hardware elements 230 and software elements 220. Hardware elements 230include a 26-slot, two-sided chassis 831 having a 22-gigabit per second(Gbps) ring midplane 832. Service blades 239 can be hot plugged intomidplane 832 form either side of chassis 831. Three types of serviceblades 239 are provided: control blades 234, processor blades 236, andaccess blades 238. In some embodiments, four processors are provided oneach service blade 239, each processor having a CPU and its own memory,allowing specialized processing to be performed on various differentdaughter cards of the blades 239.

In some embodiments, a single system chassis 831 provides a redundantback plane and blade-termination facilities 832. The access blades 238,processor blades 236, control blades 234, power supplies 241 and fantrays 242 are designed for hot-swappable operation—any of thesecomponents may be removed from service while the entire system remainsoperational. The metallic cross connect is a passive system thatprovides fail-over support to allow DS3 and DS1 access facilities to beswitched from one access blade to another access blade should an accessport or card fail. The phase 1 chassis provides 26 universal slots, eachof which may be populated with control blades, access blades, andprocessor blades. To operate, the chassis must contain at least onecontrol blade. Up to two control blades may be operational in a chassisat the same time. Access blades are added as input/output requirementsgrow, and processor blades are added as computation requirements scale.

In some embodiments, each system 230 supports up to twenty-fiveprocessing blades (PB) 236. Each processor blade 236 is designed tosupport three hundred Mbps of full duplex traffic while delivering IPservices including application firewall, LT2P, PPTP, NAT, VPN router.

In some embodiments, each system 230 supports up to two control blades(CB) 234. CBs 234 provide overall system supervision, IP routecalculation, software update management, and network managementstatistics logging services. When two CBs 234 are operational within achassis 831, they remain synchronized such that should either CB 234fail, the other CB 234 automatically takes over system operation. Inthis process all active services remain in progress. Each control blade234 is hot swappable, so that when proper procedures are followed, afailed or malfunctioning CB 234 may be removed from on operationalsystem 230 without bringing down any customer services.

In some embodiments, each CB 234 provides four Ethernet interfaces formanagement traffic. Each Ethernet interface has a distinct collisiondomain and may each be configured with a primary and secondary IPaddress. Ethernet interfaces designated for management use may beconfigured for primary and protected configurations, both sharing thesame IP address, reducing ISP IP address requirements. The CB 234Ethernet interfaces may be configured for fully meshed communicationsover diverse paths to diverse operating systems. Each CB 234 is alsoequipped with a random # seed generator for use in securityapplications.

In some embodiments, each system 230 supports up to twenty-five accessblades (AB) 238. Access blades 238 provide physical line termination,hardware-assisted IP forwarding, hardware assisted encryption services,and hardware assisted queue management. Each access blade 238 is hotswappable, so that when proper procedures are followed, a failed ormalfunctioning ab may be removed from on operational system 230 withoutbringing down any customer services. In some embodiments, 10/100Ethernet-, DS3-, and OC3-type access blades are supported by system 230.

FIG. 9 is a block diagram of one embodiment of the present invention,multiprocessor system 900 using ring network 932. In some embodiments,each of two network rings 933 and 934 connect nodes 931 together, whereeach blade 239 includes one or more nodes 931, and each node 931 isconnected to one or more processors 930. In one embodiment, each blade239 includes four nodes 931, each having one processor 930. Eachprocessor 930 include its own CPU (central processing unit) 935 andmemory 936, and optionally includes other hardware such as routers,encryption hardware, etc. Software tasks, in some embodiments, are splitup such that one processor operates on one part of the data (e.g., theLevel 7 processing) and another processor operates on another part ofthe data (e.g., the Level 3 processing). In other embodiments, thevarious processing portions of a task all run on a single processor,multiprocessing with other tasks that share that processor. Thus, thehardware provides scalability, where low-end systems include fewprocessors that do all the work, and high-end systems include onehundred or more processors and the work is distributed among theprocessors for greater speed and throughput. In some embodiments, theplurality of processors 930 in the ring configuration includes formingdual counter rotating ring connections 933 and 934, each connecting toeach of the plurality of processors 930. In some embodiments, eachprocessor is a high-performance processor such as an R12K processor fromMIPS Corporation.

In some embodiments, a separate control ring 935 is provided, connectedto all processors 930. Data passed on the control ring 935 allowscontrol communications to be passed between processors, and inparticular, allows the control blade to configure and control the otherblades in IPSX 201. In other embodiments, ring 935 is omitted, and itsfunction is overlaid on rings 933 and 934.

Logical Queue Identifiers

In some embodiments, rings 933 and 934 are packet-passing rings. Eachpacket 950 placed in the rings includes a data portion 953 and aprocessor element identifier (PEID 951) that identifies for each node931 which processor that packet is destined for, for example a 16-bitPEID that specifies one of 65526 PEs. If the PEID matches a processor onits particular node, the node 931 passes the packet to the properprocessor 930; if not, the packet is forwarded to the next node 931. Insome embodiments, each packet also includes a logical queue identifier(LQID) that identifies a software entity (for example, an object groupfor a particular VR 210) residing on that processor 930 for which thepacket is destined.

In some embodiments, every node 931 has a unique, globally unique (i.e.,unique within an IPSX 201, or within an ISP having a plurality of IPSXs201) PEID 951. In some embodiments, the way this is done is that onetakes the blade ID (e.g., five bits) and you append the PE number, whichis, for example, a eleven bits. Put that together in some fashion andyou'll get a unique ID that is globally unique within some hardwareconfiguration. Note that packets including this PEID 951 are routable.Just by looking at the PEID 951, the system 201 has a topologicalstructure so that it can route based on purely the PEID 951. The nextthing to keep in mind is that system 201 is managing multiple virtualcontext. Each VR 210 in a system 201 is a virtual router to which packetare to be directed. When packets come into node N 931 for example,system 201 needs to be able to steer it to the appropriate logicalentity, i.e., to the appropriate context and to the object channel thatit represents. Thus, a logical queue ID 952 is appended that is uniquewithin the destination processor (PE) 930. If an object in a processor930 on node 1 930 wants to set up a channel to another object aprocessor 930 on node N 930, they need to use the LQID 952 and PEID 951together represent the remote end of the object and so the system canmap the corresponding object channel, defining the object channel thatis going across the network. From a networking perspective, PEID 951looks like your IP address that routes packets like an IP address. Butonce you go to a particular node 931, the LQID looks like the UDP (UserDatagram Protocol, a TCP/IP protocol describing how messages reachprograms within a destination computer) code number. So system 201(e.g., SMS 221) essentially signals and negotiates the proper LQID tohave a channel going between those ends. This allows all the trafficcoming into a PE 930 to be steered along the appropriate object path tothe appropriate object channel on that object.

In some embodiments, an object could be talking on another channel toanother object, or to the same object, using a different channel. Inwhich case each channel uses a different LQID 952, but the same PEID951.

In some embodiments, system 201 sets up a shortcut that circumventstraffic that otherwise would be transmitted outside system 201 and thenback in (e.g., traffic between two different VRs 210 supportingdifferent customers). To set up such a shortcut, system 201 allocates adifferent LQID 952 for the shortcut. Thus, an object channel has thenormal point-to-point path for normal traffic and has amulti-point-to-point path which is used for shortcut traffic. So whenpackets come in to the object it knows whether the packet came in on thenormal path or on the shortcut path. Similarly, when the object wants touse a shortcut, it also needs to allocate a different LQID for itsoutbound shortcut traffic. One interesting distinction of shortcut pathsis that the normal point-to-point is bidirectional and data can flow inboth directions, but shortcuts data flow flows in only one direction. Soa receive site can have any number of transferred sites. Any number ofobjects can be transmitting to the same receive site. That is why it iscalled multi-point-to-point.

Further, some embodiments have different levels of shortcuts. Forexample, a packet can be sequentially passed to successive destinationsin some embodiments. Thus there can be a complex multistage path. Theshortcuts can trickle down to the ultimate end, where the packetcascades. Further, if one object knows a shortcut, it can tell otherobjects about its shortcut. So the other object does not have to come tothe first object and then be directed to the shortcut destination, butrather can directly use the shortcut it has learned about.

While service providers recognize the tremendous revenue potential ofmanaged firewall services, the cost of deploying, managing andmaintaining such services via traditional CPE-based methods is somewhatdaunting. Service providers are now seeking new service deliverymechanisms that minimize capital and operational costs while enablinghigh-margin, value-added public network services that are easilyprovisioned, managed, and repeated. Rolling out a network-based managedfirewall service is a promising means by which to accomplish this.Deploying an IP Service Delivery Platform in the service providernetwork brings the intelligence of a managed firewall service out of thecustomer premises and into the service provider's realm of control.

An IP Service Delivery Platform consists of three distinct components.The first is an intelligent, highly scalable IP Service ProcessingSwitch. Next is a comprehensive Service Management System (SMS) toenable rapid service provisioning and centralized system management. Thelast component is a powerful Customer Network Management (CNM) systemwhich provides enterprise customers with detailed network and serviceperformance systems, enable self-provisioning, and eases IT managersfears of losing control of managed network services.

In a network-based managed firewall service model, the service providerreplaces the high-capacity access concentration router at the POP withan IP Service Processing Switch. This is higher-capacity, more robust,and more intelligent access switch, with scalable processing up to 100+RISC CPUs. Just as with the access router, additional customer accesscapacity is added via installing additional port access blades to the IPService Processing Switch chassis. Unlike conventional access routers,however, additional processor blades are added to ensure wire-speedperformance and service processing.

The intelligence resident in the IP Service Processing Switch eliminatesthe need to deploy CPE devices at each protected customer site.Deployment, configuration, and management of the managed firewallservice all take place between the IP Service Processing Switch 230 andits Service Management System 221, which resides on a high-end UNIXplatform at the service provider NOC. The customer also has the abilityto initiate service provisioning and augmentation via a web-basedCustomer Network Management tool that typically resides at thecustomer's headquarters site. This is an entirely different servicedelivery paradigm, requiring minimal or no truck rolls or on-siteintervention.

To roll out a managed network-based firewall service, the serviceprovider's security staff provides a consultation to the enterprise,thereby gaining an understanding of the corporate network infrastructureand developing appropriate security policies (this is a similar processto the CPE model). Once this has been accomplished, the NOC securitystaff remotely accesses the IP Service Processing Switch (using theService Management System 221) at the regional POP serving theenterprise customer, and the firewall service is provisioned andconfigured remotely.

This model enables the service provider to leverage the enterprise'sexisting services infrastructure (leased lines and Frame Relay PVCs) todeliver new, value-added services without the requirement of a truckroll. All firewall and VPN functionality resides on the IP ServiceProcessing Switch at the POP, thus freeing the service provider fromonsite systems integration and configuration and effectively hiding thetechnology from the enterprise customer. Firewall inspection and accesscontrol functions, as well as VPN tunneling and encryption, take placeat the IP Service Processing Switch and across the WAN, while theenterprise's secure leased line or Frame Relay PVC (permanent virtualcircuit) access link remains in place. The customer interface is betweenits router and the IP Service Processing Switch (acting as an accessrouter), just as it was prior to the rollout of the managed firewallservice. Additionally, the customer has visibility into and control overits segment of the network via the CNM that typically resides at theheadquarters site.

TABLE 1 Comparison Between CPE-based and Network-based Managed FirewallTurn-up Processes Process CPE-based Model Network-based Model ServiceSecurity consultation to Security consultation to Preparation identifycustomer identify customer requirements/policies requirements/policiesCPE device(s) ordered CPE device(s) preconfigured CPE device(s) shippedto customer site Service Rollout Security technician deployed Serviceprovisioning to site(s) and policy OS/Firewall/VPN softwareconfiguration deployed loaded (server-based model) from NOC via ServicePhysical network integration Management System of device (SMS) - Notruck roll needed Additional Repeat above for each Add configurationService additional service template to SMS and Deployment duplicateacross all service points, provision with CNM - No truck rollMaintenance/ Technician on phone with Technician at POP Support customertesting CPE and testing equipment technician at POP testing equipmentMaintain inventory of spare Order units/components in servicespares/replacement region from central vendor Ship spares to customersite repository - No truck as needed roll necessary Deploy technician toIntegrate replacement customer site to complete unit component at POPrepairs if necessary

The network-based firewall model also enables service providers toquickly and cost-effectively roll out managed firewall solutions at allenterprise customer sites. As a result, secure Internet access can beprovided to every site, eliminating the performance and complexityissues associated with backhauling Internet traffic across the WAN toand from a centralized secure access point.

As the IP Service Delivery Platform is designed to enable value-addedpublic network services, it is a carrier-grade system that is morerobust and higher-capacity than traditional access routers, and an orderof magnitude more scalable and manageable than CPE-based systems. Theplatform's Service Management System enables managed firewall services,as well as a host of other managed network services, to be provisioned,configured, and managed with point-and-click simplicity, minimizing theneed for expensive, highly skilled security professionals andsignificantly cutting service rollout lead-times. The Service ManagementSystem is capable of supporting a fleet of IP Service ProcessingSwitches and tens of thousands of enterprise networks, and interfaces tothe platform at the POP from the NOC via IP address. Support forincremental additional platforms and customers is added via modularsoftware add-ons. Services can be provisioned via the SMS system'ssimple point and click menus, as well as requested directly by thecustomer via the CNM system.

Deployment of a robust IP Service Delivery Platform in the carriernetwork enables service providers to rapidly turn-up high value, managednetwork-based services at a fraction of the capital and operationalcosts of CPE-based solutions. This enables service providers to gain aleast-cost service delivery and support structure. Additionally, itenables them to gain higher margins and more market share thancompetitors utilizing traditional service delivery mechanisms—even whileoffering managed firewall services at a lower customer price point.

Business Case

This business case highlights the difference between traditionalCPE-based managed firewall services (both appliance and server-basedmodels) and managed, network-based firewall services. This comparison isbased upon both capital costs and incremental operational or “soft”costs.

This business case is modeled around a theoretical North Americanservice provider that is rolling out a managed firewall service. Theservice provider has ten regional Points of Presence (POPs) across theUS, and a single Network Operations Center (NOC). The business caseexamines growth of the managed firewall service customer base yearlyover a five-year period.

Assumptions

-   -   Three unique customer profiles        -   5 site (4 branch sites+headquarters)        -   50 site (49 branch sites+headquarters)        -   200 site (199 branch sites+headquarters)    -   Each unique customer profile has the following access        requirements        -   5 site customers            -   branch sites—56 Kbps            -   headquarters—T1        -   50 site customers            -   branch sites—56 Kbps            -   headquarters—T1        -   200 site customers            -   branch sites—128 Kbps            -   headquarters—T3    -   Greater than 500 employees at 200 site customer' headquarters    -   Less than 500 employees at 5 site and 50 site customer'        headquarters    -   Static Model—bandwidth will not change over time    -   Equal distribution of customers across each of the ten POPs    -   a traditional multiplexer resides at each POP to aggregate        access circuits up to channelized T3 interfaces in both the        access router and the IP Service Processing Switch    -   No oversubscription through the access router/IP Service        Processing Switch (ingress bandwidth=egress bandwidth)    -   An initial consultation to define customer security requirements        and policies has taken place    -   Each customer site has router in place    -   List pricing (no discounts) as of January 2000    -   $150/hour billable rate for mid-level security specialist        When to Deploy Network-Based vs. CPE-Based Firewall Services

The cost benefits of a managed, network-based Firewall Service Modelbecomes apparent when Service Providers are deploying managed firewallservices to more than twenty-nine enterprise sites. By examining thehardware and software costs alone, a network-based model becomes morecost effective to Service Providers as they begin to roll services tomore than thirty sites.

A Check Point firewall solution (one based on Check Point hardware)would cost Service Providers $478,000 to support thirty enterprisesites; whereas, a network-based firewall solution using the IP ServiceDelivery supports thirty enterprise sites for $450,000 with the abilityto support an additional twenty-five sites without an increase in cost.If the Service Provider wanted to deploy services to twenty-fiveadditional sites using a Check Point solution, the total cost of supportfifty-five sites would be $835,000—$385,000 more than the network-basedIP Service Delivery Platform. The savings of the network-based solutionwould continue to scale as additional sites were added incrementally.

If the enterprise customer does not have a Cisco 7513 or a comparablerouter installed at these sites, Service Providers would be forced toincur even greater initial start-up costs with the Check Point solution.If routers were to be installed at each enterprise site, thenetwork-based Firewall solution would become the more cost-effectivealternative when Service Providers needed to roll out services to morethan twenty-one enterprise sites.

Business Case—Models

This business case will explore four specific managed firewall servicedelivery architectures as described by interviewed service providers,systems integrators, and hardware/software vendors.

CPE-Based Models

Architecture: One Check Point/Nokia Appliance

This architecture employs a firewall/VPN CPE appliance, traditionalaccess router, and software-based centralized management system todeliver a managed firewall solution. The specific components of thissolution include:

-   -   Check Point/Nokia VPN-1/IP-330 appliance (50 user license) at        branch sites    -   Check Point VPN-1/Firewall-1 software module (unlimited user        license) on Sun Enterprise Ultra 250 server platform at        headquarters    -   Cisco 7513 access router at the service provider's POP        (redundant power, redundant RSP4)    -   Check Point Provider-1 management system at the service        provider's NOC (supports 50 customers/module) with unlimited        sites/customer on Sun Ultra 60 platform at Network Operations        Center (NOC)

FIG. 10 shows a block diagram of a system 1000 providing a ManagedFirewall Service with a CheckPoint/Nokia Appliance Solution

Architecture Two: Check Point Server

This architecture employs a firewall/VPN CPE server, traditional accessrouter, and software-based centralized management system to deliver amanaged firewall solution. The specific components of this solutioninclude:

-   -   Check Point VPN-1/Firewall-1 software module (50 user license)        on Sun 5S server platform at branch sites    -   Check Point VPN-1/Firewall-1 software module (unlimited user        license) on Sun Enterprise Ultra 250 server platform at        headquarters    -   Cisco 7513 access router at the service provider POP (redundant        power, redundant RSP4)    -   Check Point Provider-1 management system (supports 50        customers/module) with unlimited sites/customer on Sun Ultra 60        platform at NOC

FIG. 11 shows a block diagram of a system 1100, providing a ManagedFirewall Service with a CheckPoint Firewall-1 Server-based Solution.

Architecture Three: WatchGuard Appliance Model

This architecture employs a firewall VPN CPE appliance, traditionalaccess router, and software-based centralized management system todeliver a managed firewall solution. The specific components of thissolution include:

-   -   WatchGuard Firebox II Plus appliance at branch sites    -   Cisco 7513 access router at the service provider POP (redundant        power, redundant RSP4)    -   WatchGuard for MSS management system (supports 500        customers/module) with unlimited sites/customer on Compaq        Proliant 3000 Windows NT workstation platform, Event Processor        on Sun Microsystems 5S server platform

FIG. 12 shows a block diagram of a system 1200, providing a ManagedFirewall Service with a WatchGuard Appliance Solution. The CPE-basedmanaged firewall service model requires installation and configurationof system components at three network points: the service provider POP,the service provider NOC, and the customer premises.

POP Infrastructure

Each of the three CPE-based architectures explored in this analysisemploys an identical POP infrastructure. This access infrastructure isbased on the Cisco 7513 router. The base configuration for the 7513includes:

-   -   13-slot chassis    -   IOS Service Provider system software    -   (2) power supplies    -   (2) Route Switch Processors (RSP4)    -   (2) RSP4 128 MB DRAM Option    -   (2) RSP4 20 MB Flash Card Option    -   2-port Fast Ethernet Card    -   64 MB DRAM Option    -   8 MB SRAM Option

The RSP4 cards in this base configuration each consume one slot in thechassis, leaving 11 remaining for port adapters. An Ethernet card isadded for software uploads. Ingress traffic is supported via dual-portchannelized and/or dual-port unchannelized T3 cards (for dedicated T3connections). Each channelized T3 port can support up to 128 DS0 or NxT1channels Single-port OC-3 POS cards provide connectivity to the networkuplink on the egress side. These cards each occupy a single slot. Eachcard requires a programmable Versatile Interface Processor (VIP2), aswell as an additional 64 MB of DRAM and 8 MB of SRAM. The VIP2 andadditional memory reside on the T3 OC-3 cards and do not consumeadditional slots.

As described in the assumptions, a traditional multiplexer exists ateach POP to aggregate various sub-T1 customer access links up to thechannelized T3 interfaces on the Cisco 7513 router. As the POPinfrastructure installation and configuration processes are uniformacross all managed firewall service models explored in this analysis,the costs associated with these processes will not be quantified.

Network-Based Model of the Present Invention—Architecture Four

IP Service Delivery Platform 300 that includes an IP Service ProcessingSwitch (IPSX 230), a Service Management System (SMS 221) and a CustomerNetwork Management System (CNMS 222).

This architecture employs an IP Service Processing Switch and asoftware-based centralized SMS to deliver a managed firewall solution.The specific components of this solution include:

-   -   IPSX 230 (IP Service Processing Switch) at service provider POP    -   Service Management System 221 on Sun Ultra 60 server at service        provider NOC    -   InGage™ Customer Network Management System at the subscriber's        headquarters

FIG. 13 shows a block diagram of a system 1300 that provides a ManagedFirewall Service with CoSine's Network-based Solution of the presentinvention.

POP Infrastructure

The POP access infrastructure in the network-based managed firewallservice model is based on the CoSine Communications IPSX 9000 ServiceProcessing Switch. The base configuration for the switch includes:

-   -   26-slot chassis    -   Redundant power supply    -   IPNOS Base Software    -   Ring Bridge & Ring Bridge Pass-Thru (to complete midplane)    -   Control Blade (for communications with Invision Services        Management System)    -   Dual-port Channelized DS3 Access Blade    -   Dual-port Unchannelized DS3 Access Blades    -   Processor Blade    -   OC-3c POS Trunk Blade

The following tables analyze the cost structure of all of the abovemodels and projects these costs out over 5 years:

TABLE 2 Capital Cost Summary for First Year Deployment of the FourManaged Firewall Scenarios Firewall implementation Total scenarios YearCustomers* Cost Solution 1 Check Point Appliance CheckPoint 1 90 $.9 MProvider 1 (management system) Check 1 90 $37 M Point/Nokia 10 POPAppliance Total Check Point $37.9 M #1 w/0 Cisco Adding Cisco to 1 90+$2 M CheckPoint Total Check Point + Cisco $39.9M Solution 2 Check PointServer CheckPoint 1 90 $.9 M Provider 1 (management system) CheckPointNokia 1 90 $31 M 10 POP Server Total Check Point $31.9 M #2 Adding Ciscoto 1 90 +$2 M CheckPoint Total Check Point + Cisco $33.9 M Solution 3WatchGuard WatchGuard 10 1 90 $14 M POP Appliance Model WatchGuard NOC 190 $.07 Appliance Model Management Total $14.07 M WatchGuard AddingCisco to 1 90 +$2 M WatchGuard Total $16.07 M WatchGuard + CiscoSolution 4 CoSine CoSine 10 POP 1 90 $12 M Model (IPSX 9000) CoSine NOC1 90 $1.2 M (Invision Service Management System) Total CoSine $13.2 MSolution $13.2 M Savings over 1st year $39.9 − $13.2 = Check Point #1$26.7 M Savings over 1st year $31.9 − $13.2 = Check Point #2 $18.7 MSavings over 1st year $16.07 − $13.2 = WatchGuard $2.87 M Capital Costsspread - first year *Total number of customers is based on a spreadacross 5, 50 and 200 site configurations.

Pricing listed is based on information from January of 2000 and issubject to change.

TABLE 3 Capital Cost Summary for the Fifth Year Deployment of the FourManaged Firewall Scenarios Firewall implementation Total scenarios YearCustomers* Cost 1. Solution 1 Check Point Appliance CheckPoint Provider1 5 1880 $3.8 M (management system) Check Point/Nokia 10 POP 5 1880 $692M Appliance Total Check Point #1 w/0 $705.8 M Cisco Adding Cisco toCheckPoint 5 1880 +$26 M Total Check Point + Cisco $731.8 M 2. Solution2 Check Point Server CheckPoint Provider 1 5 1880 $3.8 M (managementsystem) CheckPoint Nokia 10 POP 5 1880 $590 M Server Total Check Point#2 $593.8 M Adding Cisco to CheckPoint 5 1880 $26 M Total Check Point +Cisco $619.8 M 3. Solution 3 WatchGuard WatchGuard 10 POP 5 1880 $268 MAppliance Model WatchGuard NOC 5 1880 $.25 Appliance Model ManagementTotal WatchGuard $268.25 M Adding Cisco to WatchGuard 5 1880 $26 M TotalWatchGuard + Cisco $294.25 M 4. Solution 4 CoSine CoSine 10 POP Model 51880 $106 M (IPSX 9000) CoSine NOC 5 1880 $1.2 M (Invision ServiceManagement System) Total CoSine Solution $107.2 M Savings over CheckPoint #1 5th $731.8 − $107.2 = year $624.6 M Savings over Check Point #25th $619.8 − $107.2 = year $512.6 M Savings over WatchGuard 5th $294.25− $107.2 = year $187.05 M Capital Costs spread - fifth year *Totalnumber of customers is based on a spread across 5, 50 and 200 siteconfigurations. Pricing listed is based on information from January of2000 and is subject to change.Analysis

Analysis of the four service delivery architectures for deploying amanaged firewall service reveals extremely compelling data in favor ofimplementing the network-based model based on the CoSine CommunicationsIP Service Delivery Platform. Significant advantages are gained byutilizing this model in each of the following areas:

Operational “Soft” Costs

The network-based managed firewall solution eliminates most of the steepoperational costs that are associated with deploying a CPE-basedsolution, specifically the per site truck roll and device installationcharges. The CheckPoint server-based CPE deployment and installationoperational costs alone exceed the total five-year capital equipmentinvestment required in the CoSine Communications network-based model.These costs 1400 are shown in FIG. 14. Though the installation andconfiguration costs for the POP and NOC build-outs are not quantified inthis study due to the uniformity of these processes across allsolutions, it is worthy to note that the greater capacity of the CoSineIPSX 9000 Service Processing Switch and Invision Service ManagementSystem result in fewer components (switch chassis, NOC servers andsoftware) that need to be installed and configured.

FIG. 14 shows a graph CheckPoint Operational “soft” Costs 1400. Thischart represents only operational costs associated with the Check PointCPE appliance and server models. In the context of this model, there areno soft costs associated with the CoSine Communications network-basedmodel or the WatchGuard CPE appliance model.

Security Server Appliance Truck Roll Tech/hr Installation (hr)Installation (hr) $500 $150 12 4 *Assumptions for “soft” costcalculations.Capital Costs

The network-based managed firewall solution has total capital coststhat, over the five-year customer growth period of this study, are anorder of magnitude less than the CPE-based solutions. The total capitalcosts for each solution are shown in FIG. 15.

FIG. 15 shows a graph of five year total capital cost 1500.

Time to Market, Time to Revenue

The network-based managed firewall solution enables service providers togreatly shorten the lead-time required to deploy the managed firewallservice. The removal of the CPE component from the service offeringeliminates the need to procure the device, eliminating a 1-2 week delayin service rollout. This also eliminates the 2-4 week delay that isassociated with scheduling an onsite installation.

Complexity

The network-based managed firewall solution greatly reduces thecomplexity associated with deploying the service. The number ofdistributed devices is reduced from thousands of remote customer sitesto only 10 already staffed POPs, simplifying management and maintenancesignificantly.

The network-based managed firewall service model creates a new source ofrevenue for service providers that is scalable, repeatable, andcost-effective. Leveraging centrally-managed services enables serviceproviders to derive greater value from the existing basic accessinfrastructure. The network-based model eliminates expensive onsiteinstallation and maintenance required of CPE-based solutions, andprovides a foundation to deploy additional value-added services via thesame delivery mechanism. Elimination of the CPE device also effectivelyhides the technology of the managed firewall solution from the customer,reducing internal network complexity and technical anxiety.

The CoSine Communications IP Service Delivery Platform 300 enablesservice providers to reap the benefits of deploying a network-basedmanaged firewall service. The IPSX 9000 Service Processing Switch is arobust, high-availability platform that is capable of supportinghundreds of customer sites and network-based firewalls. The InvisionServices Management System is capable of rapidly provisioning andmanaging thousands of managed firewall customers throughout an extensivenationwide network, enabling service providers to leverage volumesecurity services driven by fewer staff resources. And the InGage™Customer Network Management system empowers customer IT managers to viewand augment managed network services. The IP Service Delivery Platformpositions service providers to continuously deploy new value-addedservices to their customer base, maximizing revenues and creatingcustomer lock-in.

Service providers utilizing the IP Service Delivery Platform 300 are togain a significant competitive edge in deploying high-value IP-basedservices. The CoSine Communications solution of the present inventionenables services providers to save up to 85% on the capital costsassociated with deploying a managed firewall service over traditionalCPE-based approaches. Additionally, the CoSine solution of the presentinvention virtually eliminates the steep operational “soft” costs thatplague the CPE approach, which total $79-161 M in the 5-year modelarchitecture. These savings add up to literally tens to hundreds ofmillions of dollars over a five-year period. Furthermore, as customernumbers and bandwidth requirements increase over time, so do the costsavings. This enables service providers to gain a cost-leadershipposition while greatly increasing revenues.

In closing, the IP Service Delivery Platform (IPSDP 300) is an idealsolution for service providers seeking to offer high value managed,network-based firewall services.

In some embodiments, a set of one or more management consultants to thenetworking industry help equipment vendors, service providers andenterprises make strategic decisions, mitigate risk and affect changethrough business and technology consulting engagements. This approach istailored to each client's specific issues, objectives and budget.

These consultants are leaders in the networking industry and influenceits direction though confidential engagements for industry leaders andthrough public appearances and trade magazine articles. Theseinteractions assure clients that they will be among the first to know ofthe latest industry concepts and emerging technology trends.

Each consulting engagement is unique structured—no forced methodologiesor canned reports are employed. An integrated client/managementconsultant case team respecting and soliciting the opinions of everyoneis formed for each engagement.

The present invention provides a flexible, scalable hardware andsoftware platform that allows a service provider to easily provideinternet services, virtual private network services, firewall services,etc., to a plurality of customers. This solution can be changes toprovision each customer with more or less processing power and storage,according to individual changing needs.

One aspect of the present invention provides a method of deliveringsecurity services. This method includes connecting a plurality ofprocessors 930 in a ring configuration within a first processing system,establishing a secure connection between the processors in the ringconfiguration across an internet protocol (IP) connection to a secondprocessing system to form a tunnel, and providing both router servicesand host services for a customer using the plurality of processors inthe ring configuration and using the second processing system.

In some embodiments, one or more processors In some embodiments, tosupport a communications network, the plurality of processors includesone or more control processors, one or more access processors, and oneor more processing processors.

In some embodiments, for each of a plurality of customers, a virtualrouter 210 is formed in the first processing system 401 and is operablyconnected to a virtual router 210 formed in the second system 402.

In some embodiments, for each of a plurality of customers, a virtualprivate network 410 is formed using a visual router 210 formed in thefirst processing system 401 and operably connected to a virtual router210 formed in the second system 402.

In some embodiments, the connecting a plurality of processors in thering configuration includes forming dual counter rotating ringconnections 933 and 934, each connecting to each of the plurality ofprocessors 930.

Another aspect of the present invention provides a system of deliveringsecurity services. This system 201 includes a plurality of processors230 in a ring configuration within a first processing system 401, andmeans for establishing a secure connection 418 between the processors inthe ring configuration 411 across an internet protocol (IP) connectionto a second processing system 412 to form a tunnel, and for providingboth router services and host services for a customer using theplurality of processors in the ring configuration 411 and using thesecond processing system 412.

In some embodiments, to support a communications network, the pluralityof processors includes one or more control processors, one or moreaccess processors, and one or more processing processors.

In some embodiments, for each of a plurality of customers, a virtualrouter is formed in the first processing system and is operablyconnected to a virtual router formed in the second system.

In some embodiments of this system, for each of a plurality ofcustomers, a virtual private network is formed using a virtual routerformed in the first processing system and operably connected to avirtual router formed in the second system.

In some embodiments of this system, the plurality of processors in thering configuration includes dual counter rotating ring connections, eachconnecting to each of the plurality of processors.

Yet another aspect of the present invention provides a system 201 fordelivering security services. This second system 201 includes aplurality of processors within a first processing system connected in aring configuration, and a tunnel formed using a secure connectionbetween the processors in the ring configuration across an internetprotocol (IP) connection to a second processing system, wherein bothrouter services and host services are provided for a customer using theplurality of processors in the ring configuration and using the secondprocessing system.

In some embodiments of this second system, to support a communicationsnetwork, the plurality of processors 930 includes one or more controlprocessors 234, one or more access processors 238, and one or moreprocessing processors 236. In some embodiments, one or more of theseprocessors is packaged on a blade 239.

In some embodiments of this second system, for each of a plurality ofcustomers, a virtual router 210 is formed in the first processing system401 and is operably connected to a virtual router 210 formed in thesecond system 402.

In some embodiments of this second system, for each of a plurality ofcustomers, a virtual private network 410 is formed using a virtualrouter 210 formed in the first processing system 401 and operablyconnected to a virtual router 210 formed in the second system 410.

In some embodiments of this second system, the plurality of processors230 in the ring configuration includes dual counter rotating ringconnections 932 and 933, each connecting to each of the plurality ofprocessors 930.

Some embodiments of this second system further include a servicesmanagement system 221 that provides changeable provisioning of processorcapacity among a plurality of customers.

Some embodiments of this second system further include a servicesmanagement system 221 that provides firewall protection for each of aplurality of customers.

Some embodiments of this second system further include a servicesmanagement system 211 that provides provisioning of processor capacityamong a plurality of customers, wherein each customer's resources areisolated from those of all the other customers.

CONCLUSION

One aspect of the present invention provides a method of packet routing.The method includes connecting a plurality of processors in a network,assigning a unique processor identifier (PEID) to each of theprocessors, routing a first packet to a first one of the processorsacross the network, wherein each such packet includes a PEID valuecorresponding to a PEID of one of the processors, and wherein therouting to the first processor is based on the PEID value in the firstpacket, establishing a plurality of objects in the first processor,assigning a logical queue identifier (LQID) to a first one of theobjects in the first processor, wherein each packet also includes anLQID value corresponding to an LQID of one of the objects, and routingthe first packet to the first object based on the LQID value in thefirst packet.

Some embodiments further include assigning a plurality of differentLQIDs to the first object.

Some embodiments further include routing a plurality of packets, eachhaving a different LQID, to the first object based on the LQID value ineach respective packet.

In some embodiments, the first object is associated with a virtualrouter (VR).

Some embodiments further include establishing the first LQID with thefirst object to be used for point-to-point data traffic, andestablishing a second LQID with the first object to be used for shortcutdata traffic.

In some embodiments, the network is configured in a ring topology.

Another aspect of the present invention provides a system for routingpackets. This system includes a plurality of processors coupled to oneanother using a network, wherein each of the processors a uniqueprocessor identifier (PEID), wherein a first packet is routed into afirst one of the processors across the network, wherein each such packetincludes a PEID value corresponding to a PEID of one of the processors,and wherein the routing to the first processor is based on the PEIDvalue in the first packet, a plurality of objects in the firstprocessor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, and software for routingthe first packet to the first object based on the LQID value in thefirst packet.

In some embodiments, a plurality of different LQIDs are simultaneouslyassigned to the first object.

In some embodiments, the means for routing includes means for routing aplurality of packets, each having a different LQID, to the first objectbased on the LQID value in each respective packet.

In some embodiments, the first object is associated with a virtualrouter (VR).

In some embodiments, the first LQID is associated with the first objectto be used for point-to-point data traffic, and a second LQID isassociated with the first object to be used for shortcut data traffic.

In some embodiments, the network is configured in a ring topology.

Still another aspect of the present invention provides a system forrouting packets. This system includes a plurality of processors coupledto one another using a network, wherein each of the processors a uniqueprocessor identifier (PEID), wherein a first packet is routed into afirst one of the processors across the network, wherein each such packetincludes a PEID value corresponding to a PEID of one of the processors,and wherein the routing to the first processor is based on the PEIDvalue in the first packet, and a plurality of objects in the firstprocessor, wherein each such object is assigned a logical queueidentifier (LQID), wherein each packet also includes an LQID valuecorresponding to an LQID of one of the objects, wherein the first packetis routed to the first object based on the LQID value in the firstpacket.

Some embodiments further include a services management system thatprovides changeable provisioning of processor capacity among a pluralityof customers.

Some embodiments further include a services management system thatprovides firewall protection for each of a plurality of customers.

It is understood that the above description is intended to beillustrative, and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reviewing the abovedescription. The scope of the invention should, therefore, be determinedwith reference to the appended claims, along with the full scope ofequivalents to which such claims are entitled.

1. A method comprising: providing a service provider with a serviceprocessing switch including a plurality of blades each having aplurality of processor elements; partitioning a plurality of virtualrouters (VRs) of the service processing switch between a firstsubscriber and a second subscriber of the service provider byassociating a first set of processor element identifiers (PEIDs) with afirst set of processor elements of the plurality of processor elementssupporting a first set of VRs of the plurality of VRs partitioned to thefirst subscriber and a second set of PEIDs with a second set ofprocessor elements of the plurality of processor elements supporting asecond set of VRs of the plurality of VRs partitioned to the secondsubscriber, wherein PEIDs are assigned to each of the plurality ofprocessor elements based on a combination of a blade ID of a blade ofthe plurality of blades with which the processor element is associatedand a processor element number of the processor element; configuring thefirst set of VRs to provide a first set of managed network-basedsecurity services on behalf of the first subscriber by creating withinthe first set of VRs a first object group including a first subset ofobjects selected to be supportive of the first set of managednetwork-based security services; configuring the second set of VRs toprovide a second set of managed network-based security services onbehalf of the second subscriber by creating within the second set of VRsa second object group including a second subset of objects selected tobe supportive of the second set of managed network-based securityservices; the service processing switch providing appropriate managednetwork-based security services for the first subscriber and the secondsubscriber by steering a first subscriber packet destined for ororiginating from a site of the first subscriber to an appropriateprocessor element of the first set of processor elements supporting thefirst set of VRs and an appropriate object within the first object groupbased on a PEID value associated with the first subscriber packet and alogical queue identifier (LQID) value associated with the firstsubscriber packet, the PEID value associated with the first subscriberpacket corresponding to a PEID assigned to the appropriate processorelement of the first set of processor elements, and the LQID valueassociated with the first subscriber packet corresponding to an LQIDassigned to the appropriate object within the first object group; andsteering a second subscriber packet destined for or originating from asite of the second subscriber to an appropriate processor element of thesecond set of processor elements supporting the second set of VRs and anappropriate object within the second object group based on a PEID valueassociated with the second subscriber packet and a logical queueidentifier (LQID) value associated with the second subscriber packet,the PEID value associated with the second subscriber packetcorresponding to a PEID assigned to the appropriate processor element ofthe second set of processor elements, and the LQID value associated withthe second subscriber packet corresponding to an LQID assigned to theappropriate object within the second object group.
 2. The method ofclaim 1, further comprising: configuring the first set of VRs to providea first set of router services on behalf of the first subscriber bycreating within the first set of object groups one or more of a firstrouting object, a first packet filtering object and a first networkaddress translation object; and configuring the second set of VRs toprovide a second set of router services on behalf of the secondsubscriber by creating within the second set of object groups one ormore of a second routing object, a second packet filtering object and asecond network address translation object.
 3. The method of claim 2,further comprising providing the service processing switch within apoint of presence (POP) of a service provider network.
 4. The method ofclaim 3, wherein the first set of managed network-based securityservices include firewall inspection and access control functions. 5.The method of claim 3, wherein the first set of managed network-basedsecurity services include virtual private network (VPN) tunneling andencryption.
 6. The method of claim 3, wherein the second set of managednetwork-based security services include firewall inspection and accesscontrol functions.
 7. The method of claim 3, wherein the second set ofmanaged network-based security services include virtual private network(VPN) tunneling and encryption.
 8. The method of claim 1, wherein aservice management system (SMS) of the service provider performs saidconfiguring the first set of VRs and said configuring the second set ofVRs.
 9. The method of claim 8, wherein a first Customer NetworkManagement (CNM) system is installed at an information services (IS)headquarters site of the first subscriber, and wherein a second CNMsystem is installed at an IS headquarters site of the second subscriber,the method further comprising: providing an information technology (IT)manager of the first subscriber with the ability to (i) initiate serviceprovisioning and augmentation of the first set of VRs and (ii) obtaindetailed network and service performance information via the first CNM;and providing an IT manager of the second subscriber with the ability to(i) initiate service provisioning and augmentation of the second set ofVRs and (ii) obtain detailed network and service performance informationvia the second CNM.
 10. An Internet Protocol (IP) service deliveryarchitecture comprising: a Service Management System (SMS) residing in aNetwork Operations Center (NOC) of a service provider; an IP serviceprocessing switch, including a plurality of blades each having aplurality of processor elements, located within a service provider'sPoint of Presence (POP) and communicatively coupled to the serviceprovider via a backbone of the service provider, the IP serviceprocessing switch providing customized, managed network-based securityservices to each of a plurality of subscribers of the service providerby (i) allocating one or more virtual routers (VRs) of a plurality ofVRs to each of the plurality of subscribers based on processor elementidentifiers (PEIDs) associated with a set of processor elements of theplurality of processor elements supporting the plurality of VRs, (ii)instantiating object groups within the one or more VRs allocated to eachsubscriber based on security service needs of the subscriber, (iii)assigning logical queue identifiers (LQIDs) to objects of the objectgroups; and (iv) steering received packets to appropriate objects of theobject groups based on PEID values and LQID values associated with thepackets, the PEID values containing information indicative of a blade IDof a blade of the plurality of blades and a processor element number ofa processor element of the set of processor elements associated with theblade; a Customer Network Management (CNM) system communicativelycoupled with the IP service processing switch and located at a sitewithin each subscriber; wherein the SMS enables centralized deployment,configuration and management of a managed network-based security serviceon behalf of the plurality of subscribers; and wherein the CNMs providethe respective subscribers with the ability to (i) initiate serviceprovisioning and augmentation of the customized, managed network-basedsecurity services and (ii) obtain detailed network and serviceperformance information.
 11. An Internet Protocol (IP) serviceprocessing switch comprising: a plurality of blades each having aplurality of processor elements (PEs), each of the plurality of PEsrunning a plurality of virtual routers (VRs) configured to providecustomized security services to a subscriber of a plurality ofsubscribers of a service provider by (i) creating object groups withinthe plurality of VRs in accordance with security service needs ofrespective subscribers and (ii) assigning logical queue identifiers(LQIDs) to objects of the object groups, the objects including one ormore of a routing object, a packet filtering object a firewall objectand a network address translation (NAT) object, each of the plurality ofPEs being assigned a PE identifier (PEID), based on a PE number of thePE and a blade ID of a blade of the plurality of blades with which thePE is associated, that is unique within the IP service processingswitch; a packet-passing ring coupling the plurality of blades incommunication; and wherein upon a blade of the plurality of bladesreceiving a packet, the blade inspects a PEID value associated with thepacket and if the PEID value corresponds to a PE of the plurality of PEson the blade, then the packet is steered to an object of the pluralityof VRs running on the PE that corresponds to the LQID value, and if thePEID value does not correspond to any of the PEs of the plurality of PEson the blade, then the packet is forwarded to the next blade of theplurality of blades on the packet-passing ring.